Security systems and methods to reduce data leaks in enterprise networks

Abstract

Disclosed are embodiments of a security system for reducing data leaks by checking information flows between resources of a network. When an information flow is attempted between a sending resource, which can be anywhere in the network, and a receiving resource residing at a specific host within the network, a host labeler can determine whether information is allowed to flow from the sending resource to the receiving resource. The sending resource and the receiving resource can each have an applicable label, and each label can comprise zero, one, or more taints. For each taint having an active secrecy characteristic in a label of the sending resource, the host labeler can require that there be a matching taint with active secrecy characteristic in the receiving resource. If this condition is not met, the security system can block the information flow between the sending and receiving resources.

Description

CROSS-REFERENCE TO RELATED APPLICATIONS[0001]This application claims priority to and the benefit under 35 U.S.C. §119(e) of U.S. Provisional Patent Application No. 61 / 384,475, filed 20 Sep. 2010, which is incorporated herein by reference in its entirety as if fully set forth below.GOVERNMENT LICENSE RIGHTS[0002]This invention was made with Government support under Agreement No. CNS-0916732, awarded by the National Science Foundation. The Government has certain rights in this invention.TECHNICAL FIELD[0003]Various embodiments of the present invention relate to network security and, particularly, to security systems and methods that reduce or prevent data leaks in enterprise networks.BACKGROUND[0004]Organizations must control where private information spreads and to whom it is accessible; this problem is referred to in the security industry as data loss / leak prevention (DLP). Commercial solutions for DLP are based on scanning content, where the content of traffic flowing outside an or...

AI Technical Summary

Benefits of technology

The system effectively reduces data leaks by strictly controlling information flows, allowing unmodified legacy applications to be secured, and integrating with existing user directories, providing comprehensive protection and minimizing user intervention while preventing data leaks from both internal and external threats.

Problems solved by technology

This approach proves difficult or impossible in most organizations where applications are proprietary and run on commodity operating systems, and modifying source code for such applications is not possible.

In contrast, lowering secrecy or integrity, such as by unsetting a characteristic from a taint 210, can potentially cause data leaks, and may thus require explicit user action.

Specifically, where the labels 200 are tracked at the granularity of memory pages, and not at the granularity of a process that consists of several memory pages, system calls are not sufficient to track all flow of information between memory pages.

Images